Skip to content

osquery can't close win pipe #57

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Closed
blessedvictim opened this issue Jul 11, 2018 · 3 comments
Closed

osquery can't close win pipe #57

blessedvictim opened this issue Jul 11, 2018 · 3 comments

Comments

@blessedvictim
Copy link

After any query on del of SpawnInstance I get an ignored exception
Exception ignored in <bound method SpawnInstance.__del__ of <osquery.management.SpawnInstance object at 0x021854F0>> pywintypes.error: (1, 'DicsonnectNamedPipe', 'Incorrect function.')
my script:
import osquery instance = osquery.SpawnInstance() instance.open() instance.client.query("<some query>")
Now i use some dirty "hack" as after
instance.client.query("<some query>")
i do:
instance.connection=None
My machine os:
Windows 7x64

@JarryShaw
Copy link
Contributor

This issue remains on version 3.0.6. I used del (calling __del__ internally) to make a more reasonable pipe closing, since there's no close function.

>>> import osquery
>>> instance = osquery.SpawnInstance()
>>> instance.open()
>>> del instance
Exception ignored in: <function SpawnInstance.__del__ at 0x000000D3ABF62678>
Traceback (most recent call last):
  File "C:\Users\fakepath\AppData\Local\Programs\Python\Python37\lib\site-packages\osquery\management.py", line 89, in __del__
    self.connection.close()
  File "C:\Users\fakepath\AppData\Local\Programs\Python\Python37\lib\site-packages\osquery\extension_client.py", line 55, in close
    self._transport.close()
  File "C:\Users\fakepath\AppData\Local\Programs\Python\Python37\lib\site-packages\thrift\transport\TTransport.py", line 156, in close
    return self.__trans.close()
  File "C:\Users\fakepath\AppData\Local\Programs\Python\Python37\lib\site-packages\osquery\TPipe.py", line 35, in close
    win32pipe.DisconnectNamedPipe(self._handle)
pywintypes.error: (1, 'DisconnectNamedPipe', 'Incorrect function.')

Environment:

  • Windows 10 Pro
  • osquery-python: 3.0.6
  • ossuary: 3.3.0
  • pywin32: 224

@theopolis theopolis reopened this Aug 16, 2019
outhex added a commit to outhex/osquery-python that referenced this issue Jun 18, 2021
@hotab
Copy link

hotab commented Dec 23, 2022

This still happens in 3.0.7 (latest version from pip) on win 10

Problem disappears when using outhex@19691b9 - this fix

hotab added a commit to hotab/osquery-python that referenced this issue Dec 23, 2022
Issue 1: in TPipeServer, the CloseHandle call happened on a None _handle after the super() call.
Issue 2: Client raises an issue as described in osquery#57, correct call seems to be CloseHandle.

This commit fixes both issues
@filiagees
Copy link

filiagees commented Apr 10, 2024

This still happens in 3.0.7 (latest version from pip) on win 10

Problem disappears when using outhex@19691b9 - this fix

@hotab This fix worked for me, too.
Thanks for pointing out.

I'm using win10, with:

  • osquery==3.0.7
  • pywin32==306
  • pywin32-ctypes==0.2.2

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
Development

No branches or pull requests

6 participants